An easier variation of an older technique using "mock folders" i.e. C:\Windows \System32 (notice the trailing space after Windows\) and DLL hijacking to bypass UAC and do other naughty things.
If you can write to c:\windows why do you need to bypass UAC? You obviously own the machine already, no?